GM Settles for $12.75M Over Unlawful Sale of California Drivers’ Data
General Motors will pay $12.75 million to settle charges of unlawfully selling Californians’ connected car data.
Why it matters: This marks the largest privacy penalty under the California Consumer Privacy Act (CCPA) to date and signals stricter enforcement of connected vehicle data practices, impacting legal risk analysis across the automotive and tech sectors.
- GM sold location and driving data from its OnStar service to Verisk Analytics and LexisNexis Risk Solutions between 2020 and 2024.
- The settlement includes a five-year ban on GM selling driving data to consumer reporting agencies.
- GM must delete retained driving data within 180 days unless consumers provide express consent.
- This case is the first CCPA enforcement action centered on data minimization.
General Motors agreed to pay $12.75 million in a settlement announced by California regulators after the company allegedly shared location, contact, and driving behavior data from its OnStar service with data brokers Verisk Analytics and LexisNexis Risk Solutions without driver consent between 2020 and 2024.
California Attorney General Rob Bonta stated, “General Motors sold the data of California drivers without their knowledge or consent and despite numerous statements reassuring drivers that it would not do so.” OnStar data reportedly included names, geolocation, and driving behavior for hundreds of thousands of Californians. GM earned about $20 million nationwide through these sales.
Under the terms, GM is prohibited from selling driving data to consumer reporting agencies for the next five years and must establish a comprehensive privacy program ensuring compliance with the CCPA. The company is also required to delete previously collected data within 180 days unless drivers opt in.
San Francisco District Attorney Brooke Jenkins underscored broader concerns, stating, “Modern cars are rolling data collection machines. Californians must have confidence that they know what data is being collected, how it is being used, and what their opt-out rights are.”
This is the largest CCPA settlement to date and introduces precedent for enforcement actions focused on data minimization principles. The development follows recent scrutiny of automakers’ sharing of consumer data with insurance and other third parties and signals increased legal and compliance risks for connected vehicle data handling.
By the numbers:
- $12.75M — GM’s settlement amount with California regulators
- 2020–2024 — Period during which OnStar driving data was sold
- $20M — Estimated total revenue GM earned nationwide from such data sales
Yes, but: Details on how data brokers utilized the purchased information and the exact number of Californians affected remain undisclosed.